What happened
CVE-2026-126767 (CWE-77 / prompt injection) affects OpsTree REMS through 1.0.0. By submitting crafted chat input to POST /api/v1/rca/chat, an authenticated user can instruct the assistant to ignore its rules and disclose the hidden system prompt, exposing internal orchestration instructions and potentially the data-handling constraints the model is expected to enforce.
Why it matters
This is a deployed LLM-application prompt-injection/privacy leak: because the endpoint is authenticated but the assistant trusts user-controlled chat content as instruction, an authenticated user can exfiltrate the internal system prompt that encodes the application's rules and guardrails, enabling them to craft follow-on prompts that bypass the app's intended behavior.
Attack vector
An authenticated user sends crafted chat input to the RCA chat endpoint that instructs the assistant to ignore its rules and reveal its internal hidden system prompt / orchestration instructions. The assistant complies, disclosing the prompt-engineered instructions that govern its role, tool usage, and data-handling rules.
Affected systems
OpsTree REMS through 1.0.0 — POST /api/v1/rca/chat endpoint.
Mitigation
Upgrade to a released version after 1.0.0 that hardens prompt-injection resistance; treat the system prompt as secret and avoid embedding secrets or privileged instructions in it; apply output filtering to block system-prompt-leak phrasing.